Extracted

• • Target

    2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver

  • Size

    2.9MB

  • MD5

    14b3ba84931f9d0d261decb8ccbaf079

  • SHA1

    a77659ab265213a2b38384b2ae8e1a722c1d7b2e

  • SHA256

    854717a4571738e4ed8d49e7d1f9c77cf02f2aa26d7fd49cd4195b68aa44cb94

  • SHA512

    97c65b9d2390b0e8af2a7a4510130a92c0be4c90399223b8f5b70eddc1b916329cb005fda7c3c5209c7d83a4c4637605a4cff37304960965e2a5af045d390b98

  • SSDEEP

    49152:iiQagHg5EVhwQd+qrW+i1w+Tqc0KxZbDOCwMDbyeKw3FGMFvfjPW21I3iIJR:3g7hRdj9iMlHBSFBWZR

  Score

  10^/10

  meshagentpersonalbackdoordiscoveryevasionpersistenceprivilege_escalationrattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Meshagent family

    meshagent

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2